Test-mode checkout pitfalls: how a shop takes no money without an error

Payment providers give you a test mode so you can buy things with fake cards. It is also the easiest way to run a shop that takes no money for a week without noticing: link the live site to the test checkout, and every real card is quietly refused.

How it slips through

• Test and live are separate. Products, ids and entitlements must be created twice.
• The checkout host differs only by a test. prefix, easy to miss in a URL.
• Nothing errors. A declined real card on a test checkout is the system working.

Make the wrong combination refuse to build

Our checkout mode is a build setting: off, test or live. Each product carries both ids, { test, live }, and the checkout link is built from whichever the mode asks for. Then one guard: a build that is indexable and in test mode throws. The only way past it is a separate, explicitly named flag, and that flag puts an amber test-mode banner across the top of every page.

if (DODO_MODE === "test" && SITE.indexable && !TEST_ON_PRODUCTION) {
  throw new Error("Test checkout must never reach the production site.");
}

Two more that caught us

1. The download service had its own mode setting. The deploy command now sets both together, so checkout and key checks cannot point at different worlds.
2. Local development is always test mode, so nothing on localhost can take real money.

Before going live, make one real purchase and refund it. The rest of the shape is in selling downloads without a backend.